Question 1

A retail company is evaluating the adoption of a cloud-based point-of-sale (POS) system. While the system offers the opportunity for real-time data analysis and inventory management, it also poses a risk of service disruption due to internet dependency. In the context of ISO 27005, how should the company integrate these factors into its risk management process?

Options :

A : By considering both the opportunity and the risk in their decision-making.

B : By prioritizing the risk of service disruption over the benefits.

C : By focusing only on the opportunity for real-time data analysis.

D : By rejecting the cloud-based system due to its reliance on internet connectivity.

Answer: A

Question 2

A manufacturing company is evaluating the risk associated with outdated machinery. On a numerical rating scale from 1 to 5, how should the consequence of machinery failure be rated, taking into account production disruption and repair costs?

Options :

A : 3 - Moderate, considering some production disruption and manageable repair costs.

B : 4 - High, due to significant production disruption and high repair costs.

C : 2 - Low, since production can be temporarily shifted to other facilities.

D : 1 - Negligible, as there are backup machines available.

Answer: B

Question 3

An IT manager at a government agency is tasked with implementing a risk management framework that aligns with federal requirements for information security. Which NIST publication should they use as a primary reference to ensure compliance with federal standards, and what is its significance in this context?

Options :

A : NIST Cybersecurity Framework (CSF).

B : NIST SP 800-53, "Security and Privacy Controls for Federal Information Systems and Organizations."

C : NIST SP 800-34, "Contingency Planning Guide for Federal Information Systems."

D : NIST SP 800-30, "Guide for Conducting Risk Assessments."

Answer: B

Question 4

A university is updating its information security risk assessment for its research data storage systems. To identify risks effectively, what method should be emphasized?

Options :

A : Asset-based risk identification, including physical and digital data assets.

B : Conducting vulnerability scans of the data storage systems.

C : Reviewing compliance with academic data management standards.

D : Assessing the impact of potential data breaches on research integrity.

Answer: A

Question 5

A telecommunications company is evaluating the risk of service disruptions due to natural disasters. To effectively analyze this risk, which technique should be applied?

Options :

A : Monte Carlo simulation to model the impact of various disaster scenarios.

B : Fault tree analysis to identify potential causes of service disruptions.

C : Delphi technique involving experts to estimate the probability of natural disasters.

D : Failure mode and effects analysis (FMEA) to assess the resilience of the network.

Answer: A

Higher Test Marks with Free Online ISO-27005-LRM Exam Practice

Buying Options: